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The Examiner has rejected Claims 1-4, 6-8, 1 0-17, and 20-22 under 35 U.S.C y^m^ 
l'0f(§ls b'eing anticipated by et al. (USPN 5,99 1,8^^^U^ 

disagrees with this rejection, especially in view of the amendments made,herem^bpye.^/^p>i V 

Specifically, in the latest action, the Examiner equates applicant's claimed ^ M ^mw.v- 
"accounting information" to include the attack data shown in Figure 7. See below. 




The Examiner continues by presenting the following argument with respect to 
applicant's claimed "discarding at least a portion of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect." 



Conklin allegedly teaches: Mi.e., network traffic measurement and 
monitoring for reporting information about captured packets and 
detecting intrusion into the network and into computers connected 
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to the network for denial of service) [see Abstract and Figs. 6-9 
and Col. 1, Line 10 - Col. 2, Line 41.3* 

However, even if the Examiner's statement is true (i.e. that Conklin suggests ^. ^ -.r?; -\~xv *■ 
network traffic measuremenrfand monitoring for . . .), the Examiner has sti_H#p^&^ 
how Conklin me£0$l$^s claimed "discar#n§ttl^stja portion of the^cf^ 
information that occurs during a surge in network traffic, based^on the monitored aspect^ v . . j/v^-; 

Specifically, the Examiner has not shown how the attack data (which the „ . . . . * , . 

Examiner relies on to meet applicant's claimed "accounting information") is discarded 
when such attack data occurs during a surge in network traffic, b ased on the monitored 
aspect . 

Again, the only context in which Conklin even suggests any sort of discarding of 
data is in the following excerpt: 

"If, there is no indication of an actual or potential intrusion, 
then the examined packet data is discarded. When a packet or 
accumulation of packets match a predefined intrusion profile the 
Intrusion Detection function identifies the network traffic as a 
reportable activity will construct a data structure which contains 
a date/ time stamp indicating the time of detection, the source and 
destination internet Protocol (IP) addresses, an assigned message 
identifying the event detected. This data structure is passed to 
the Alert Notification function for processing." (see col. 5, 
lines 23-32) 

Thus, while applicant teaches and claims discarding accounting information when 
such accounting information occurs during a surge in network traffic (which may or may 
not be resulting from an attack), Conklin discards packet data when there is no indication 
of an actual or potential intrusion . Thus, not only do Conklin's teachings fail to meet 
applicant's claims, but Conklin teaches away from applicant's claimed invention, thus 
further rendering it unobvious* 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
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s ingle prior art reference. Verdegaal Bros. v. Union Oil Co. OfCaliforniay$\4Y-2&62%^ Ur.io.. 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 19S7). Moreover, the identical invention must be./:,< r: JT'i 4^ 
shown in as complete detailas contained in the claim. 
p^^.uv ^ Co/868 F.2d 1226; 1236' 9US^ 

Vi;* v /cl:|^^4 arranged as required bv the cllim^i' U.^ * - ": 

V-t. 

This criterion has simply not been met by the Conklin reference, as noted above. 
Nevertheless, despite these paramount differences and in the spirit of expediting t the^ : , .> a »a>^*i * m-^vs? ~* 
prosecution of the present application, applicant has amended each of the independent . : ... ;.. 

claims to include the following or similar subject matter: 



> ' 'after receiving the accounting information, discarding at least a portion of 
the accounting information that occurs during a surge in network traffic, based on 
the monitored aspect^ 

wherein the portion of the accounting information is discarded to prevent 
an overload of subsequent processing " (emphasis added). 

To this end, applicant now emphasizes the advantage of the presently claimed 
invention, namely the discarding of accounting information, as claimed, for the specific 
purpose of preventing an overload of subsequent processing. Again, Conklin discards 
when there is no attack and associated surge, while applicant discards, as claimed, for the 
purpose of preventing an overload of subsequent processing. A notice of allowance or a 
specific prior art showing of each of the foregoing limitations, along with the remaining 
claim elements, is respectfully requested. 

To even further emphasize such distinction, applicant has further amended Claim 
1 1, as follows: 

"computer code for discarding at least a portion of the accounting 
information that occurs during a surge in network traffi c and is expendable , based 
on the monitored aspec t, after receiving the accounting information; 
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computer code for allowing at least a portion of rema ining acco"^ tin ^^£y : I; i<- 
i ' 
information to pass'to- subseoifent accounting process ing. aftenrecej^Mfe 

wherein the portion Gf theiaccounting information is di scarded to P re 5g^^^%#tfe- 
an overload of thfc sui^^feG^unting processin|f^ 

Thus, in the present claim, it is further emphasized that expendable information is . * . . . ,m 
discarded* while at least a portion of remaining accounting information i s ; allowed, to pass vBTr , t ^naurau: 
to subsequent accounting processing. Again, a notice of allowance or a specific prior art^ . 
showing of each of the foregoing limitations, along with the remaining claim elements, is 
respectfully requested. 

Even still, to even further distinguish applicant's claimed invention, applicant has 
further amended Claim 20, as follows: 




" logic for aggregating at least a portion of the accounting information prior 
to passing to subsequent accounting processing, based on the monitored aspect 
after receiving the accounting information; 

logic for allowing at least a portion of remaining accounting information 
to pass to the subsequent accounting processing, after receiving the accounting 
information; 

wherein the portions of the accounting information are discarded and 
aggregated to prevent an overload of the subsequent accounting processing; 

wherein the subsequent accounting processing includes operation and 
business support system processing , (emphasis added). 
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* v a .:.Tni the present claim, it is further emphasized that an aggregation function is 
.•■ .••-'virnul'emented in combination with ;the discarding to preventan^^ 

.:'•** ■ * - accounting processing;. The instant claim further emphasizos : th.e fact. that the subseqiieni^^ v : : .; 




limitations, along with the remaining claim elements, is respectfully requested. 



It is further noted that the Examiner's application of the prior art to the remaining;, f 
claims is replete with deficiencies. Just by way of example, with respect to Claims 3 and, . . 
13, the Examiner continues to rely on Figure 6 to make a prior art showing of appellant's 
claimed "wherein the accounting information is discarded for dealing with heavy network 
traffic." After careful of Figure 6, it clearly fails to disclose, teach or even suggest such 
limitations. Again, Conklin deals with network attacks, not "dealing with heavy network 
traffic,*' by discarding accounting information, as claimed. 

With respect to Claims 4 and 14, the Examiner relies on col. 4, line 52 - col. 5, 
line 45 to make a prior art showing of appellant's claimed "generating a summary of the 
accounting information." Such excerpts, however, do not disclose, teach or even suggest 
"accounting information", let alone "generating a summary of the accounting 
information," as claimed. 

Regarding Claims 7 and 16, the Examiner relies on col. 4, line 52 - col. 5, lines 
30-67; and Figures 6-8 to make a prior art showing of appellant's claimed "wherein 
monitoring the at least one aspect of the received accounting information includes 
monitoring a rate of receipt of the accounting information." Such excerpts, however, do 
not disclose, teach or even suggest "a rate of receipt of the accounting information." 
Instead, there is a mere mention of a time of day, number and types of packets, common 
destination/source address combinations, etc. A number of packets constitutes an amount, 
not a "rate," as claimed. 
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With respect to Claims S and 1 7, the Examiner relies on col, 4, line 52 - col. 5, 
• " lines 30-67; and-Frgures-S-8 to make a priori-showing of appellaiit's clamied^h^ei^ 

'""*' ^ monitoring the at least one aspect of the received accounting information -includes cneaspc ' 
H - • • -b< 4 detec iting- "wh kMh the ;rat e of receipt df ^a#Oii]|ting in fprpati|>n^ 

"a rate of receipt of the accounting information." Instead, there is a mere mention of a . 
time of day, number and types of packets, common destination/source address . , > 
combinations, etc. It is noted that Conklin does not even suggest a "rate " let alone 
"detecting whether the rate of receipt of the accounting information exceeds a , . ~ 
predetermined amount , 1 ' as claimed. 

Regarding Claims 9 and 19, such subject matter is rejected under 35 U.S.C. 
103(a) as being unpatentable over Conklin et al. (USPN 5,991,881) in view of Trcka et aL 
(USPN 6,453,345). With respect to such claims, the Examiner relies on col. 21, lines 24- 
28 to make a prior art showing of appellant's claimed "wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a load on a system 
receiving the accounting information." It appears that the Examiner has again not taken 
into consideration the full weight of appellant's claims. 

Specifically, such excerpt simply suggest "peak loads," but does not disclose, 
teach or even suggest monitoring a load on a system receiving accounti ng information in 
the specific context of "monitoring the at least one aspect of the received accounting 
information includes monitoring a load on a system receiving the accounting 
information," as opposed to the traffic itself. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge general ly available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
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claimed combination and the reasonable expectation of success, must both be fb^nd^th^. ^, 
prior art and not based on appellant's disclosure. In re Vaeck, 947 F.2d 488, 20 USPq2d.^.. M} , asclos, -< 



case of obviousness has not been met, since the Examiner's proposed combination does : " ; 
not disclose, teach or suggest appellant's claim language, as. set forth hereinabove.^^ ...^ .. ,., .... 

A notice of allowance or a specific prior art showing of each of the foregoing.,, 
limitations, along with the remaining claim elements, is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is hereby authorized to charge any fees that may be due or credit any 
overpayment to Deposit Account No. 50-1351 (Order No. XACTP001). 




P.O. Box 721120 

San Jose, CA 95172-1120 

408-505-5100 
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